5 ms·

This multi-billion dollar company is somehow managing to mismanage responsible disclosure and their bug bounty program in such a way that it's actually detrimen

This multi-billion dollar company is somehow managing to mismanage responsible disclosure and their bug bounty program in such a way that it's actually detrimental to them. It's astonishing. It's so easy to get soft wins running a program like this. Communicate with the reporter, make sure you have enough of a mandate inside the company to get things fixed in time, it's a boon to your reputation even if the reporter gets to publicly disclose the weakness. Now they still have the public disclosure of the weakness, but they get the added reputation hit of seemingly not caring, or not being able to get serious security issues that jeopardize their users fixed. Not a good look for a company supposedly obsessed with users' privacy.

prox 5y ago
That department is probably in the navel staring face of the business lifecycle, where managers are just absorbed in their own world of projects and goals instead of looking out and making sure the day to day work runs smoothly.
- goldenkey 5y ago
  That department is essentially the red-headed stepchild. Think about it, what manager would want to be in charge of a team with no feature set timeline, milestones, etc? It's exactly like you said, having a functional and working team that gets the day to day bugs fixed, it doesn't gain any clout in the company. Instead, you need to be in the AI or hardware division, so you can be respected as a 'pioneer.' It's all about values. Security and lets say, all submitted bugs fixed within 30 days...that would be a pioneering status for a company. Good luck getting approval for funding and staffing for that though in a company obsessed with those navel-gazing commercials about space travel and such...
  - prox 5y ago
    That makes me wonder if the tenure changed under Tim. Steve was much more of a perfectionist.
    - deleted 5y ago
      [deleted]
Svoka 5y ago
Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything except "application specific password" you could generate to use for POP3/IMAP access. When reported I was confronted by AI; unwelcoming replies "you don't understand this is a feature, not a bug". But, regardless, I was sent a bunch of scary emails with threats not to disclose this to anyone. I gave up, I had other stuff going on in my life. In two years, with fanfares some "security firm" discovered a bug and rolled out the full self-PR campaign with nice pictures describing a bug and how they got 1337 money. At that point I realized that bug bounty is only for professionals who have connections and willing ears to listen to them. I understand that from standpoint of big companies, they are flooded with requests, but it doesn't makes me feel better. I reported a serious security issue whole two years before they fixed it, but got absolutely nothing for it except threats and gaslighting.
- volta83 5y ago
  So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?
  - paulryanrogers 5y ago
    These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
    - paulryanrogers 5y ago
      ^half hearted bug bounties
    - volta83 5y ago
      > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.
deleted 5y ago
[deleted]
cromka 5y ago
I wonder if the EU's next (justifiable) excuse to ride those companies in court is going to be "the gross negligence to protect user data". Not that anyone would expect them to ever be bug-free, but those recent reports on how they handle the white-hats, they really deserves to be slapped with some hefty fine. And it wouldn't really be the money, but the bad publicity that would actually cost them something. Just imagine those Google ads "mocking" iPhone's "security/privacy" after them being found guilty of not giving two f*cks. Disclosure: saying this as a fully-invested but otherwise pissed Apple user.

prox 5y ago

That department is probably in the navel staring face of the business lifecycle, where managers are just absorbed in their own world of projects and goals instead of looking out and making sure the day to day work runs smoothly.

goldenkey 5y ago
That department is essentially the red-headed stepchild. Think about it, what manager would want to be in charge of a team with no feature set timeline, milestones, etc? It's exactly like you said, having a functional and working team that gets the day to day bugs fixed, it doesn't gain any clout in the company. Instead, you need to be in the AI or hardware division, so you can be respected as a 'pioneer.' It's all about values. Security and lets say, all submitted bugs fixed within 30 days...that would be a pioneering status for a company. Good luck getting approval for funding and staffing for that though in a company obsessed with those navel-gazing commercials about space travel and such...
- prox 5y ago
  That makes me wonder if the tenure changed under Tim. Steve was much more of a perfectionist.
  - deleted 5y ago
    [deleted]

Svoka 5y ago

Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything except "application specific password" you could generate to use for POP3/IMAP access. When reported I was confronted by AI; unwelcoming replies "you don't understand this is a feature, not a bug". But, regardless, I was sent a bunch of scary emails with threats not to disclose this to anyone. I gave up, I had other stuff going on in my life. In two years, with fanfares some "security firm" discovered a bug and rolled out the full self-PR campaign with nice pictures describing a bug and how they got 1337 money. At that point I realized that bug bounty is only for professionals who have connections and willing ears to listen to them. I understand that from standpoint of big companies, they are flooded with requests, but it doesn't makes me feel better. I reported a serious security issue whole two years before they fixed it, but got absolutely nothing for it except threats and gaslighting.

volta83 5y ago
So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?
- paulryanrogers 5y ago
  These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
  - paulryanrogers 5y ago
    ^half hearted bug bounties
  - volta83 5y ago
    > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.

deleted 5y ago

[deleted]

cromka 5y ago

I wonder if the EU's next (justifiable) excuse to ride those companies in court is going to be "the gross negligence to protect user data". Not that anyone would expect them to ever be bug-free, but those recent reports on how they handle the white-hats, they really deserves to be slapped with some hefty fine. And it wouldn't really be the money, but the bad publicity that would actually cost them something. Just imagine those Google ads "mocking" iPhone's "security/privacy" after them being found guilty of not giving two f*cks. Disclosure: saying this as a fully-invested but otherwise pissed Apple user.